Encrypt in transit
Use a valid domain-matching certificate, redirect HTTP to HTTPS, and configure OAC to always sign origin requests.
Public content.
Private storage.
A secure deployment checks both sides: visitors can reach the website, and anonymous requests cannot read the origin directly.
ACCESS DESIGNAllow the path.
Allow the path.
Restrict the shortcut.
S3 Block Public Access stays enabled. A bucket policy permits the CloudFront service principal to read objects only on behalf of the intended distribution.
That policy is scoped to the distribution ARN. It does not grant anonymous users direct access to the bucket.
A checkable claim: request index.html through the custom domain, then request the same object anonymously through the S3 REST URL. The first should succeed; the second should return an access-denied response.
Limit permissions
Deployment credentials should reach only the project resources and necessary service operations. API keys belong outside source control.
Verify independently
Record real status codes, redirect locations, certificate verification, and AWS configuration. A successful-looking screenshot does not establish every security property.
Keep recovery predictable
Review consequential changes, preserve known-good configuration, and verify the website again after restoring it.